During the last couple of weeks I have listed hundreds of domains that are part of an ongoing spam campaign advertising bogus “Work at home jobs”. The websites advertised by these spams were designed to look like they belong to commercial TV channels, sometimes illegally including the CNBC logo and many of the domain names contain terms like “cnbc”, “nbc”, “abc” or “news”.

Here is a sample screen shot:

The fact that these people illegally use trademarks of major corporations should already be a major red flag. This is not just some dubious get-rich-quick scheme, is is the work of a criminal operation. The sites are hosted in different countries, including the US, Russia, China and Romania. The registrant details that can be looked up via WHOIS often only list a proxy service.

Here is text from a typical site used in this scam:

news8reports.com | Work At Home Mom Makes $6,498/Month Part-Time

Can $97 Really Turn Into $6795? We Investigated…
News 8 Reports Investigates Online Work at Home Programs…

Are There Any Legit Work At Home Programs?

With unemployment numbers extremely high, everybody is looking to make a few extra bucks these days. Many people are turning to work at home programs… But, which ones are REAL and which ones are SCAMS?

We just had to find out… So we set out to do some research ourselves. We came across a blog by Jessica Holmes of Tokyo, 40.

Oh, Tokyo? By sheer coincidence that’s where I live. But looking at the source of the website, I could see that the HTML code simply looks up the IP address from which the site is accessed and outputs the city associated with it. If you were reading the same article from an IP address in Baltimore it would say that “Jessica Holmes” lived in Baltimore!

That little bit of cheating and the attempt to be mistaken for commercial TV channel websites are just the tip of the iceberg of this criminal scam. In an attempt to avoid being caught by spam filters, many of the spams abuse URL shortening services such as bit.ly or redi.ec to hide the domain names of the fake news sites that are getting blacklisted by us. Many of the spams appear to have been sent from hacked Hotmail, Gmail and AOL mail accounts. The spam appears designed to get unemployed people to pay $97 dollars upfront (“Can $97 Really Turn Into $6795?” headline on the fake site) in the hope of being able to support their families with whatever is offered, when they’re really only going to support the criminals who run this scam.

Here are the WHOIS details of the above mentioned site:

Registrant:
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: NEWS8REPORTS.COM
Created on: 30-Jan-10
Expires on: 30-Jan-11
Last Updated on: 28-Sep-10

Administrative Contact:
Private, Registration NEWS8REPORTS.COM@domainsbyproxy.com
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax — (480) 624-2598

Technical Contact:
Private, Registration NEWS8REPORTS.COM@domainsbyproxy.com
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax — (480) 624-2598

Domain servers in listed order:
NS1.WIREDTREE.COM
NS2.WIREDTREE.COM

Be extremely skeptical of any job offers that involve any of the following:

1. Anything sent as spam (unsolicited bulk email)
2. Work at home jobs that supposedly pay thousands of dollars a month that anybody can do
3. Upfront payments or purchases in order to get a job (in any real job the employer pays you, not vice versa!)
4. Hard sales tactics, such as web sites that pop up a dialog when you’re trying to close them
5. Signs of deception or hidden identities.

URL shortening abuse examples:

cnbcfinancenow21.tk = bit.ly/cYANOE
cnbc2.com = bit.ly/cVE04V
cnbc2.com = bit.ly/9am423
cnbc2.com = bit.ly/9yLTQz
cnbc2.com = bit.ly/ajmIpO
cnbc2.com = bit.ly/dehCDk
nbcnow28.tk = is.gd/h1cqG
cnbc2.com = bit.ly/a7azZN
nbcnow28.tk = is.gd/h1cbJ
cnbc2.com = bit.ly/a81vu0
cnbc2.com = bit.ly/9fe1sd
cnbc2.com = bit.ly/aROkLP
cnbc2.com = bit.ly/aZSKYx
cnbc2.com = bit.ly/9DCGzQ
cnbc2.com = bit.ly/9avkAn
cnbc2.com = bit.ly/dcEmpU
cnbc2.com = bit.ly/9lXpMJ
nbc40news.net = bit.ly/bjI19K
nbc39news.net = bit.ly/alVIfU
nbc40news.net = bit.ly/cTHQ2Y
nbc40news.net = bit.ly/aYrKCa
nbc40news.net = bit.ly/dieJ5R
nbc39news.net = bit.ly/dbkWxV
nbc40news.net = bit.ly/9uOD6H
nbc41news.net = bit.ly/c7gCyu
nbc41news.net = bit.ly/gqRtBZ
nbc41news.net = bit.ly/f5VsQz
cnbc14news.net = bit.ly/fot9an
nbc41news.net = bit.ly/i0jOK2
nbc41news.net = bit.ly/gFJe8e
nbc41news.net = bit.ly/fgpSVG
nbc7newsmedia.net = bit.ly/9lBObh
cnbc3news.net = bit.ly/eGEYhq
cnbc3news.net = bit.ly/g2u93V
msnbcnews4.net = bit.ly/fGupR0
msnbcnews4.net = bit.ly/hq2gX3
msnbcnews4.net = bit.ly/i8iYaK
nbcnews7.net = bit.ly/h0Kw5O
cnbc3news8.com = bit.ly/hnQyy7
cnbc3.com = bit.ly/hIxAuy
msnbcnews11.net = bit.ly/i6CZN3
msnbcnews11.net = bit.ly/fmRgsD
nbcnews12.net = bit.ly/gANdZw
msnbcnews11.net = bit.ly/gadsv7
msnbcnews11.net = bit.ly/hBXuRH
cnbc7.com = bit.ly/eUPW7N
cnbc7.com = bit.ly/edNttc
cnbc7.com = bit.ly/elDyof
cnbc7.com = bit.ly/fAe9oj
cnbc7.com = bit.ly/hg6Kvi
cnbc7.org = bit.ly/h6bTfo
cnbc7.org = bit.ly/gpuFHr
cnbc7.org = bit.ly/idIJoX
cnbc7.org = bit.ly/hOBmjw
cnbc7.org = bit.ly/gLbsrp
cnbc7.org = bit.ly/eq12aU
cnbc7.com = bit.ly/e43Iib
cnbc7.org = bit.ly/dPKBna
cnbc7.org = bit.ly/e10nTV
cnbc7.com = bit.ly/f5Z7rq
cnbc7.org = bit.ly/guMMYG
cnbc7.com = bit.ly/ez7AJF
cnbc7.com = bit.ly/grGu4j
cnbc7.com = bit.ly/gNwG4N
cnbc7.com = bit.ly/hdv9Xr
cnbc7.com = bit.ly/eMp8ce
cnbc7.org = bit.ly/hLrMSK
cnbc7.org = bit.ly/dKWCHA
cnbc7.com = bit.ly/eDe0ud
cnbc7.com = bit.ly/ft1H3q
cnbc7.org = bit.ly/fGPn0R
cnbc7.org = idek.net/3dtS
nbcbeforehotmail.info = bit.ly/gmv7PJ
nbcbeforehotmail.info = bit.ly/i5dFZm
nbcbeforehotmail.info = bit.ly/eQLUik
nbcbeforehotmail.info = bit.ly/hJnzSD
nbcbeforehotmail.info = bit.ly/fpBgps
nbcbeforehotmail.info = bit.ly/hYbl1G
nbcbeforehotmail.info = bit.ly/f75etY
nbcbeforehotmail.info = bit.ly/i0DGVt
nbcbeforehotmail.info = bit.ly/h1rrCw
nbcbeforehotmail.info = bit.ly/gEdAoY
nbcbeforehotmail.info = bit.ly/gm3Ti8
nbcbeforehotmail.info = bit.ly/ihbu2g
nbcbeforehotmail.info = bit.ly/hj7GKp
nbcbeforehotmail.info = bit.ly/gkbCcG
nbcbeforehotmail.info = bit.ly/e8RuVs
nbcbeforehotmail.info = bit.ly/hoVraB
nbcbeforehotmail.info = bit.ly/hFLA4Q
nbcbeforehotmail.info = bit.ly/h9lmA3
nbcbeforehotmail.info = bit.ly/f082ws
nbcbeforehotmail.info = bit.ly/gfhNP6
nbcbeforehotmail.info = bit.ly/emkJsL
nbcbeforehotmail.info = bit.ly/hoVraB
nbcbeforehotmail.info = bit.ly/hFLA4Q
nbcbeforehotmail.info = bit.ly/gfhNP6
nbcbeforehotmail.info = bit.ly/hoVraB
nbcbeforehotmail.info = bit.ly/gfhNP6
bannewsnbc.info = bit.ly/gysB7G
nbcbeforehotmail.info = bit.ly/hoVraB
nbcbeforehotmail.info = bit.ly/gfhNP6
bannewsnbc.info = bit.ly/gysB7G
cnbc20medianet.com = bit.ly/gfgAUo
bannewsnbc.info = bit.ly/g2xI9o
bannewsnbc.info = bit.ly/eL2oQx
bannewsnbc.info = bit.ly/hTX1Tr
msn7nbc.info = bit.ly/eBVtbo
polonbcnews.info = bit.ly/fkXMia
msn7nbc.info = bit.ly/hQDC2d
polonbcnews.info = bit.ly/fC0Gvj
msn7nbc.info = bit.ly/fGAVTr
polonbcnews.info = bit.ly/fBGs29
msn7nbc.info = bit.ly/eIgvhO
msn7nbc.info = bit.ly/dFjrGX
msn7nbc.info = bit.ly/dYIcw5
msn7nbc.info = bit.ly/gn896l
msn7nbc.info = bit.ly/er1dSj
msn7nbc.info = bit.ly/g61R4u
news42local.info = is.gd/gMaJL
ultranews23.com = tiny.cc/UltraYjlSnews23
ultranews23.com = tiny.cc/Ultra0Delnews23
newsfamily7.com = a.nf/2tmNJV
ultranews23.com = tiny.cc/Ultra6sPYnews23
newsfamily7.com = a.nf/2tmNJV
news42local.net = is.gd/gMtdl
ultranews23.com = tiny.cc/UltradmSJnews23
ultranews23.com = tiny.cc/UltraMfIanews23
ultranews23.com = tiny.cc/UltrameYanews23
news42local.net = bit.ly/ctBb1V
news42local.info = bit.ly/d1MSVM
news42local.co.uk = is.gd/gNatd
ultranews23.com = tiny.cc/UltratIfOnews23
ultranews23.com = tiny.cc/UltrabS2znews23
news42local.co.uk = is.gd/gNiZ6
news42local.co.uk = is.gd/gNrYT
news42local.co.uk = bit.ly/bw7lIF
news42local.co.uk = is.gd/gNuTt
news42local.net = bit.ly/a7lyX5
ultranews23.com = tiny.cc/UltraOqI9news23
ultranews23.com = tiny.cc/UltraJ5s7news23
ultranews23.com = tiny.cc/UltrameYanews23
ultranews23.com = tiny.cc/UltrakP48news23
news42local.biz = bit.ly/9CZnHc
news42local.net = bit.ly/9o9F07
news42local.net = bit.ly/b4VA1w
news42local.co.uk = is.gd/gNF4a
news42local.co.uk = bit.ly/aqgrW8
news42local.net = bit.ly/cvFRT2
ultranews23.com = tiny.cc/UltraMfIanews23
ultranews23.com = tiny.cc/UltraCWiRnews23
ultranews23.com = tiny.cc/Ultrap5RVnews23
ultranews23.com = tiny.cc/UltratbGGnews23
ultranews23.com = tiny.cc/Ultran79Unews23
news42local.co.uk = is.gd/gNMW5
newsfornow1.net = is.gd/gMuAg
news42local.co.uk = is.gd/gNPVV
news42local.biz = bit.ly/bfcDWc
ultranews23.com = tiny.cc/UltrajUqYnews23
ultranews23.com = tiny.cc/UltrahiT7news23
ultranews23.com = tiny.cc/UltraJFv2news23
ultranews23.com = tiny.cc/UltrafG3rnews23
ultranews23.com = tiny.cc/Ultra0TQWnews23
ultranews23.com = tiny.cc/UltraaRW8news23
ultranews23.com = tiny.cc/Ultra5xnEnews23
ultranews23.com = tiny.cc/UltraXt90news23
ultranews23.com = tiny.cc/UltrafKw7news23
ultranews23.com = tiny.cc/UltrabJQbnews23
ultranews23.com = tiny.cc/UltraSsFOnews23
news88local.com = is.gd/gPDsy
news88local.biz = is.gd/gOPq1
news88local.org = is.gd/gOPUX
news88local.com = is.gd/gOQI1
ultranews23.com = tiny.cc/UltraffIjnews23
news88local.com = is.gd/gOXqs
news88local.com = is.gd/gOXXx
news88local.org = is.gd/gP4Aj
news88local.org = is.gd/gP6yN
ultranews23.com = tiny.cc/UltraGUWenews23
news88local.net = is.gd/gPQ1S
ultranews23.com = tiny.cc/Ultrabjwynews23
ultranews23.com = tiny.cc/Ultragxl9news23
news88local.net = is.gd/gPftN
news88local.org = is.gd/gPgb1
news88local.org = is.gd/gPlkm
ultranews23.com = tiny.cc/UltragLHCnews23
news88local.biz = is.gd/gPoBK
news88local.com = is.gd/gPqMb
news88local.biz = is.gd/gPwP4
news88local.org = bit.ly/bttwD6
ultranews23.com = tiny.cc/UltrazuZWnews23
ultranews23.com = tiny.cc/Ultrax70Dnews23
news88local.biz = bit.ly/dCR623
news88local.biz = bit.ly/ajGmui
newsfamily7.com = a.nf/2tmNJV
news88local.com = bit.ly/aOBoYO
newsfamily7.com = a.nf/2tmNJV
news88local.net = bit.ly/9C49kE
news88local.biz = bit.ly/cJqASy
news88local.biz = bit.ly/9EXjGv
news88local.net = bit.ly/9AbRRU
news88local.com = bit.ly/bMxJFA
news88local.biz = bit.ly/9TPphi
news88local.com = bit.ly/c2aoIR
news88local.com = bit.ly/cwUiTp
news88local.org = bit.ly/ceXIWe
news88local.org = bit.ly/ayN7mB
news88local.org = bit.ly/dwGy6e
news88local.net = bit.ly/blEQQW
newsfamily7.com = a.nf/2tmNJV
newschan42.com = a.nf/kBJUtc
newsfamily7.com = a.nf/2tmNJV
newsfornow1.net = bit.ly/9r6UkK
thenews4later.net = bit.ly/9C9ZPP
local50news.com = bit.ly/aH9MEQ
local50news.com = bit.ly/czTx2t
thenews4later.net = bit.ly/9C9ZPP
local50news.com = bit.ly/cWQ62S
local50news.com = bit.ly/9mUM9t
local50news.com = bit.ly/dwFAzE
ultranews23.com = a.nf/kV7WWd
thenews4later.net = bit.ly/bOdJk8
businessnews10.tk = is.gd/hleaz
ultranews23.com = korta.nu/f84ji
newscenter10.co.cc = is.gd/hmLhQ
businessnews21.tk = bit.ly/9o2AvQ
cnn65news.com = bit.ly/ciDaWR
cnn65news.com = bit.ly/9ieRys
ultranews23.com = retwt.me/1PKxk
local87news.com = bit.ly/cdyzi5
local87news.com = bit.ly/9Y5OEA
local87news.com = bit.ly/cdyzi5
local87news.com = bit.ly/9Y5OEA
local87news.com = bit.ly/cdyzi5
local87news.com = bit.ly/9WlaQT
local87news.com = bit.ly/cdyzi5
ultranews23.com = retwt.me/1PKxk
nbc40news.net = bit.ly/bjI19K
nbc39news.net = bit.ly/alVIfU
nbc40news.net = bit.ly/cTHQ2Y
nbc40news.net = bit.ly/aYrKCa
nbc40news.net = bit.ly/dieJ5R
nbc39news.net = bit.ly/dbkWxV
local99news.net = bit.ly/ac1Nt7
ultranews23.com = retwt.me/1PKxk
nbc40news.net = bit.ly/9uOD6H
ultranews23.com = bacn.me/jrbj
local99news.org = bit.ly/bm8NPu
local99news.org = bit.ly/bFi8J6
local99news.com = bit.ly/bCzIrN
local99news.com = bit.ly/ae3EY2
nbc41news.net = bit.ly/c7gCyu
local99news.net = bit.ly/9PCUP4
local99news.com = bit.ly/dgeAan
local99news.org = bit.ly/9wqppM
local99news.net = bit.ly/aTLwlD
ultranews23.com = bacn.me/jrbl
local99news.com = bit.ly/dBacHx
local99news.org = bit.ly/chHCja
nbc41news.net = bit.ly/c7gCyu
local99news.org = bit.ly/bCB5uB
local99news.com = bit.ly/9IBs4W
local99news.org = bit.ly/dsl0Om
ultranews23.com = bacn.me/jrbj
nbc41news.net = bit.ly/gqRtBZ
nbc41news.net = bit.ly/f5VsQz
local90news.net = bit.ly/gKy1NM
cnbc14news.net = bit.ly/fot9an
nbc41news.net = bit.ly/i0jOK2
ultranews23.com = bacn.me/jrbp
nbc41news.net = bit.ly/gFJe8e
nbc41news.net = bit.ly/fgpSVG
nbc7newsmedia.net = bit.ly/9lBObh
ultranews23.com = bacn.me/jrbn
local46news.org = bit.ly/fcPLLc
local46news.org = bit.ly/hGN6E0
cnbc3news.net = bit.ly/eGEYhq
cnbc3news.net = bit.ly/g2u93V
ultranews23.com = retwt.me/1PKxk
ultranews23.com = bacn.me/jrbk
ultranews23.com = retwt.me/1PKxk
msnbcnews4.net = bit.ly/fGupR0
msnbcnews4.net = bit.ly/hq2gX3
ultranews23.com = retwt.me/1PKxk
ultranews23.com = bacn.me/jrbj
ultranews23.com = bacn.me/jrbp
ultranews23.com = bacn.me/jrbk
ultranews23.com = bacn.me/jrbl
ultranews23.com = bacn.me/jrbm
msnbcnews4.net = bit.ly/i8iYaK
ultranews23.com = bacn.me/jrbl
nbcnews7.net = bit.ly/h0Kw5O
cnbc3news8.com = bit.ly/hnQyy7
abcnews12.net = bit.ly/gnP0r0
abcnews12.net = bit.ly/fr2era
abcnews12.net = bit.ly/eLpV1n
abcnews12.net = bit.ly/gT7zEx
abcnews12.net = bit.ly/evDdv9
abcnews11.net = bit.ly/i0AdRc
abcnews11.net = bit.ly/hB00NV
abcnews11.net = bit.ly/haD230
abcnews12.net = bit.ly/eC6Nib
abcnews11.net = bit.ly/eH1AEF
abcnews12.net = bit.ly/gdA3tj
abcnews12.net = bit.ly/hTHdgL
abcnews11.net = bit.ly/ggMB1g
abcnews12.net = bit.ly/dVHHsG
abcnews11.net = bit.ly/f34jVH
abcnews12.net = bit.ly/hMf52P
abcnews11.net = bit.ly/fycYPy
msnbcnews11.net = bit.ly/i6CZN3
msnbcnews11.net = bit.ly/fmRgsD
nbcnews12.net = bit.ly/gANdZw
msnbcnews11.net = bit.ly/gadsv7
cbsnews12.net = bit.ly/hurzVY
msnbcnews11.net = bit.ly/hBXuRH
cbsnews12.net = bit.ly/hjGq7d
cbsnews12.net = bit.ly/gWwBD8
cbsnews12.net = bit.ly/fj1m2B
here4newslocal.net = bit.ly/hQ68Yq
nb18newstoday.info = i5.be/SY6
usnews3.com = a.nf/K3gdA1
newswebguide.com = tinyurl.com/6x2b4qf
cnn65news.net = bacn.me/k55j
cnn65news.net = bacn.me/k59p
global81news.net = bacn.me/k6mp
newschan42.com = a.nf/lrW38G
usnews3.com = a.nf/K3gdA1
newschan42.com = a.nf/lrW38G
walletnews1.info = bit.ly/eRuN9c
newschan42.com = a.nf/lrW38G
local22news.biz = bacn.me/kbzd
newschan42.com = a.nf/lrW38G
usnews3.com = a.nf/K3gdA1
newschan42.com = a.nf/lrW38G
local22news.biz = bit.ly/dGHb1x
usnews3.com = a.nf/K3gdA1
ultranews23.com = a.nf/GleoGo
usnews3.com = a.nf/K3gdA1
ultranews23.com = a.nf/GleoGo
usnews3.com = a.nf/K3gdA1
ultranews23.com = a.nf/GleoGo
usnews3.com = a.nf/K3gdA1
ultranews23.com = a.nf/GleoGo
usnews3.com = a.nf/K3gdA1
ultranews23.com = a.nf/GleoGo
usnews3.com = a.nf/K3gdA1
ultranews23.com = a.nf/GleoGo
usnews3.com = a.nf/K3gdA1
ultranews23.com = a.nf/GleoGo
bannewsnbc.info = bit.ly/gysB7G
ultranews23.com = a.nf/GleoGo
bannewsnbc.info = bit.ly/gysB7G
bannewsnbc.info = bit.ly/g2xI9o
bannewsnbc.info = bit.ly/eL2oQx
bannewsnbc.info = bit.ly/hTX1Tr
polonbcnews.info = bit.ly/fkXMia
polonbcnews.info = bit.ly/fC0Gvj
polonbcnews.info = bit.ly/fBGs29
usnews3.com = a.nf/K3gdA1

Hosted in Russia:

news7bfge.com
news7ffvg.com
news7ghuf.com
news7hdtr.com
news7hhgs.com
news7hjkl.com
news7kjih.com
news7mnvb.com
news7oksi.com
news7oplk.com
news7riue.com
news7ttdd.com
news7tuij.com
news7uuij.com
news7vfys.com
news7connect.com
news7link.com
news7sync.com
news7technology.com
news7udomain.com
news7uinternet.com
news7usource.com
news7utechnology.com
accessnews11.com
b2news11.com
buynews11.com
bytenews11.com
compunews11.com
connectnews11.com
cybernews11.com
directnews11.com
domainnews11.com
e-news11.com
enews11.com
eznews11.com
i-news11.com
inews11oi.com
infounews11a.com
internetnews11.com
internews11.com
news11asuy.com
news11hjgf.com
news11iuyr.com
news11kdjc.com
news11qoiu.com
news11quyw.com
news11qwuo.com
news11vyru.com

Hosted in Hong Kong:

buycnbc1aok.com
internetcnbc1wo.com
procnbc1wo.com
sellcnbc1wo.com

Hosted in the USA:

cnbc20market.com
cnbcjobs20.com
cnbc20early.com